{
  "id": 18494763,
  "title": "Learning Network Traffic Analysis with Wireshark: My First Practical Investigation",
  "url": "https://urgent.news/2026/11/06/learning-network-traffic-analysis-with-wireshark-my-first-practical",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T12:01:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jesse_ochoi/learning-network-traffic-analysis-with-wireshark-my-first-practical-investigation-55g9"
  },
  "original_language": "en",
  "account": "This article documents a personal learning exercise where the author used Wireshark, an open-source network protocol analyzer, to inspect traffic generated by their own computer over Wi-Fi. The goal was to understand what happens when devices communicate over a network, not to investigate a confirmed cyberattack.\n\nThe author installed Wireshark on a Windows 11 operating system and started a live packet capture on their active Wi-Fi interface. The capture duration was approximately 30 seconds, resulting in 145 initial packets captured.\n\nThrough examining DNS, TLS, TCP connection establishment, IP addresses, endpoints, TCP conversations, and TCP reset investigation, the author gained a basic understanding of key networking concepts.\n\nDNS analysis helped identify which domains a device attempts to resolve and correlate those domains with returned IP addresses. TLS traffic revealed useful metadata and handshake information, even when content is encrypted. TCP connection establishment involved a three-way handshake process (SYN, SYN-ACK, ACK). The author learned to distinguish between private and public IPv4 addressing. Endpoint statistics showed the highest observed packet count belonged to the author's own computer. TCP conversation analysis demonstrated communication between individual pairs of endpoints. No TCP reset packets were observed in this particular capture.\n\nThe author emphasizes that unusual traffic does not automatically mean malicious activity and stresses the importance of context, identifying the source, understanding communication patterns, and gathering supporting evidence before drawing conclusions. The exercise was limited to a short capture and should not be considered a full network security assessment.\n\nOverall, this hands-on technical challenge provided the author with practical experience using Wireshark to understand network communication, moving beyond networking theory to actually see what happens when devices communicate over Wi-Fi.",
  "summary": "A hands-on networking exercise exploring DNS, TLS, TCP, IP addressing and network conversations. Introduction Understanding how devices communicate across a network is an important skill in networking and cybersecurity. For my second practical technical challenge, I installed Wireshark, an open-source network protocol analyzer, and used it to inspect traffic generated by my own computer over…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}